[39] Project Mercury beg
an in 1958 with some basic systems research and a number of
feasibility studies to determine if a spacecraft could be built which
would sustain man in orbital space and return him safely to earth.
Although it was recognized that some system development would be
required, many of the spacecraft systems could be synthesized from
existing hardware. A top priority was placed on the spacecraft
production from the contract award in 1959, and 3 years later
Astronaut John H. Glenn, Jr., completed three orbital passes about
the earth. In this time span, design, development, and qualification
of the spacecraft and its systems were accomplished nearly
concurrently. The ground and flight- test programs, which included
hundreds of wind-tunnel tests and parachute drops from aircraft,
provided an opportunity to develop flight systems and acquire
operational experience as the program progressed. Though a continuing
attention to engineering detail by technical specialists and
management personnel throughout the project, the spacecraft and its
systems were qualified for suborbital flight in approximately 2 years
from the spacecraft contract award date. Many lessons have been
learned which were not only applied to Mercury systems development,
but which have been applied in more advanced space projects.
Interesting conclusions regarding system performance can be derived
by reviewing all of the flight results. The spacecraft control system
was a source of considerable trouble during the project. However,
when inflight failures of this type occurred, it was the backup
capability of the pilot which made possible the successful completion
of the mission. In fact, the pilot's ability to control accurately
the spacecraft attitude was instrumental in three of the four manned
orbital flights in completing the mission successfully when a
malfunction was present in the automatic system. One of these
control-system malfunctions, an electrical anomaly during Astronaut
Cooper's mission and the only one of major significance in the
spacecraft throughout the entire 34-hour flight, was successfully
circumvented by the pilot's manual control during the critical
retrofire and reentry maneuvers.

Introduction

The initial goal of Project Mercury was to
place a man into orbit successfully and return him safely to earth,
and this objective was fulfilled in February 1962 by the flight of
Astronaut John H. Glenn, Jr. This objective was confirmed 3 months
later by the flight of Astronaut M. Scott Carpenter. The final two
missions in Mercury constituted a continuation of a program to
acquire new knowledge and operational experience in manned orbital
space flight. The ninth Mercury-Atlas mission (MA-9) was planned for
up to 22 orbital passes and was the concluding flight in the United
States' first manned space program. The primary objectives of the
MA-9 mission were to evaluate the effects on the astronaut of
approximately 1 day in orbital flight, to verify that man can
function as a primary operating system of the spacecraft; and to
evaluate the combined performance of the astronaut and the
spacecraft, which was specifically modified for the 1-day
mission.

The MA-9 spacecraft, Faith 7, used by
Astronaut Cooper in successfully performing the fourth United States
manned orbital mission was basically similar to those used for
previous orbital flights. The major exceptions were system
modifications prompted by the extended nature of the mission, and
these changes will be [40] discussed in later
paragraphs. It is important to note, however, that since the original
design of the Mercury spacecraft all major system concepts have
remained essentially unaltered. Although some design and early
development were conducted prior to the official award of the prime
contract, the Mercury spacecraft was developed, qualified, and met
its original objective of manned orbital flight 3 years after the
spacecraft contract award in 1959. In this brief span of time, many
lessons have been learned and much experience has been gained in the
design, development, and operation of manned orbital flight systems.
In this paper, the intent is to describe briefly the original design
philosophy, discuss the system development and qualification
experiences, and present a summary of the experiences relating to
systems performance.

Design Philosophy

In the initial design of the Mercury
spacecraft, two guidelines were firmly established: (1) to use
existing technology and off-the-shelf equipment wherever practical
and (2) to follow the simplest and most reliable approach to system
design. These guidelines were administered to provide for the most
expedient realization of program objectives. The original Mercury
concept also included a number of mandatory design requirements which
were imposed on the spacecraft contractor:

(1) The spacecraft must be fitted
with a reliable launch-escape system which would rapidly separate the
spacecraft with its crew from the launch vehicle in case of an
imminent disaster.

(2) The mode of reentry into the earth's
atmosphere would be by drag braking only.

(3) The spacecraft must carry a retrorocket
system capable of providing the necessary impulse to bring the
vehicle out of orbit.

(4) The spacecraft design should place prime
emphasis on the water- landing approach.

(5) The pilot must be given the capability of
manually controlling spacecraft attitude.

In many design areas, there existed no
previous experience in reliable system operation which could be
applied to the Mercury concept, and new development programs had to
be initiated. In addition, there was no information pertaining to
man's capability to operate under space environmental conditions,
particularly environmental weightlessness; therefore, all of the
spacecraft systems which relate to crew recovery from orbit had to be
designed for automatic operation and many had to include redundancy.
It has since been learned that man is not only a contributory element
but a necessary part of the spacecraft. It is important to note that
because of the pilots demonstrated ability to function as a primary
operating system of the spacecraft, some of the redundant elements
were not required and were deleted.

The spacecraft systems (fig. 3-1) include the
heat protection, mechanical and pyrotechnic spacecraft control,
communications, instrumentation, life support, and electrical and
sequential systems. The mechanical and pyrotechnic system group
comprises the separation devices, the rocket motors, the landing
system and the internal spacecraft structure. These systems have been
described in previous literature (refs. 1 to 10); therefore, detailed
descriptions are not included in this paper.

The design requirements stated earlier
involved certain implications for these systems The launch-escape
system was found to be most practical if it incorporated a solid
rocket motor to propel the spacecraft rapidly away from the launch
vehicle during an abort in the atmosphere. This type of system needed
to provide a high level of thrust for a brief time period should be
easily handled in the field and should require a minimum of
servicing. The tower arrangement could be readily assembled to the
spacecraft and jettisoned during powered flight once it no longer was
required for abort.

An important design feature of the Mercury
spacecraft was the favorable manner in which the astronaut was
exposed to flight accelerations. For all major g-loads, which occur
during powered flight, launch-escape motor thrusting, posigrade motor
thrusting, retrograde motor thrusting, reentry, parachute deployment
and touchdown, the pilot experienced acceleration in the most
favorable manner, one that forces him into the couch (fig.
3-2).

The mode of reentry was specified to be drag
braking only because of simplicity. This concept implied that the
configuration should be a blunt body with high drag properties having
a slender afterbody, primary because of heating considerations. Thus
the bell shaped Mercury [41] configuration was
evolved, and the heat-protection system was devised to accommodate
this shape. Originally, a beryllium thermal shield employing the
heat-sink principle was specified. The specification was later
changed to provide a more efficient ablation-type heat shield, which
was used on all Mercury- Atlas orbital missions. Because the heat
flux was expected to be considerably less on the afterbody than at
the heat shield, a combination of insulation and thin shingles
constructed of an alloy to withstand high temperature was calculated
to be sufficient in maintaining the temperature of the pressure
vessel at a safe level. The exterior finish of the spacecraft body
was intentionally made a dull black because of its high emissivity
and, therefore, favorable thermal radiation properties.

Again, because of their reliability and ease
of handling and servicing, solid propellants were chosen for the
retrorocket system. For even greater reliability, however, a system
of three solid rocket motors, any two of which would effect a safe
reentry, was chosen. These three rocket motors, together with three
additional rockets to effect spacecraft- launch-vehicle separation,
were assembled in a jettisonable package to permit a clean reentry
configuration.

For the period during and after touchdown, the
spacecraft had to meet two basic requirements. These requirements
were: ( a ) the structure had not only to retain its integrity such
that it would be habitable after landing and (b) the touchdown
decelerations had to be reduced to an acceptable level. Touchdown
deceleration was primarily limited by the human tolerance to
acceleration; and, because of the blunt shape of the spacecraft,
touchdown decelerations of as high as 50g could have resulted even
for a water landing. Therefore, a landing-shock attenuation system
was designed which consisted of a fiberglass fabric bag with holes in
it and was attached between the spacecraft structure and the ablation
shield. Prior to landing, the ablation shield would be deployed and
the shield weight would extend the bag, which would fill with air and
provide a cushion against the landing shock. The landing bag
arrangement adequately attenuated the landing deceleration loads to
approximately 15g.

In addition to the automatic and rate control
modes of the attitude control system, two manual control modes, one
electrical and the other mechanical, were provided the astronaut.
This control-mode arrangement had the feature that,

[42] in the event of a
spacecraft power failure, the direct-linkage mechanical mode would
still be available for control. The two manual control modes were
each supplied control-system fuel from separate tanks for additional
reliability. Although the thrust units were designed to provide an
impulse sufficient for the majority of spacecraft maneuvers, these
redundant manual control modes could be used simultaneously, if
desired, in critical situations, such as retrofire and reentry, where
rapid response to undesirable attitude rates might become
necessary.

A monopropellant reaction control system using
hydrogen peroxide as the fuel was chosen for the spacecraft control
system to provide the simplest system design and installation.
Furthermore, similar systems had already been developed for use on
other space vehicles. A flexible bladder under pressure provided a
positive means of fuel expulsion.

Many challenging design problems were
encountered in the remaining spacecraft system because of the new
operating environment. As a result of the need to provide
flight-control support on the ground, the requirement for multiple
redundancy and high reliability in the communications system was
evident. Although part of the instrumentation system was not required
for flight safety and mission success, certain parameters, such as
those which indicate the physiological well-being of the crew and the
propel operation of critical spacecraft systems, were necessary for
effective flight control and monitoring. The remainder of the
instrumentation data was acquired to complement the flight-control
parameters for use in postflight

[43] analyses of system
performance. New design areas were opened up in the fields of gas
partial pressure measurement and of bioinstrumentation, such as long
term attachment of human sensor leads. The life-support- system
design considerations involved a development task since it was
concerned with the sustenance of the astronaut and his protection
from the hard vacuum of space, as well as from the widely varying
temperature conditions associated with an orbital-flight profile.
This system also was required to provide for the management of the
cooling and drinking water in the spacecraft, the food to be consumed
by the pilot, and his normal liquid wastes, again in the weightless
environment. Although pressure suits and cooling equipment had been
used in high-performance aircraft, only art of this experience could
be directly applied to the design of the Mercury environmental
control system because of weightless flight and more demanding
performance requirements. In the electrical and sequential design
area, the application of previous design work and use of
off-the-shelf components was made. But the very nature of the mission
and the requirement for reliability' automation, and system
redundancy imposed a degree of complexity somewhat greater than any
previous manned flight system. This increased electronic complexity
in turn, made it more difficult to insure interface compatibility,
eliminate stray voltages (back-door circuits), and minimize system
sensitivity to current transients.

As an example of the consequences of stray
voltages, the Little Joe-1 mission, the first launch attempt using a
full-scale Mercury spacecraft, is cited. This test, conducted at
Wallops Island, Va., was in the final moments of countdown when,
during a spacecraft battery charging operation, a stray voltage
initiated the launch escape sequence. The spacecraft was separated by
the escape motor from the launch vehicle, and the drogue parachute
was properly deployed. Because the battery had been only partially
charged, sufficient current was not available to deploy the main
parachute, and the spacecraft was destroyed upon landing. This
back-door circuit was subsequently located and eliminated.

Because of work conducted immediately prior to
and in the early period following contract award, the system-design
phase of the project proceeded at a rapid pace. Wind-tunnel research,
studies by prospective subcontractors and vendors, the joint
participation of key NASA and other government installations, and
early design studies by the eventual prime contractor all helped to
facilitate the design effort and make possible the early availability
of test hardware.

Based on the total Mercury experience, one of
the underlying principles during the initial design period should be
an emphasis placed on ''designing for operation." For example, one of
the lessons learned was that the instrumentation system should be
designed with mission flexibility as a guide, such that, in the later
phases of the program, new instrumentation requirements can be
handled with a minimum of complication. In still another area, it was
learned that component accessibility can be extremely important where
schedule demands become critical. Certain time-critical systems and
short-life components must be easily accessible in order to minimize
the degree of disturbance to other systems and the time required to
replace these types of units. Because of the weight and volume
constraints, this concept could not faithfully be applied in the
design evolution of the Mercury spacecraft, and significant penalties
have been experienced wherever items needed to be removed under a
tight schedule. It was learned in Mercury that all systems requiring
manual operation by the astronaut must be designed with the
limitations of the cabin volume (see fig. 3-3), suit mobility, and
weightlessness in mind.

Development and
Qualification

As in any development program, one of the
original ground rules at the outset of Project Mercury was to conduct
a logical and progressive test program. This concept was closely
maintained from the beginning, of the project through the flight of
Astronaut Cooper last May. Success in certain phases of this test
progression has made possible the elimination of certain backup or
follow-on flights. Since the time that Mercury was initially
conceived, literally thousands of individual tests have been
conducted in which test articles were used in all forms from
components to full-scale spacecraft and under all combinations of
real and [44] simulated operating conditions. For example, during
the 1-year period from November 1959. about 10 months after the prime
contract was awarded, to November 1960, some 270 hours were spent in
testing the environmental control system in the altitude chamber,
with a man wearing a pressure suit in the chamber to load the circuit
more realistically. Early in 1961, further tests were conducted,
often using astronauts, in the centrifuge to qualify the
environmental system under acceleration loads.

For convenience, the spacecraft-system testing
can be grouped into ground tests and flight tests of special test
articles. The ground tests, in turn, can be categorized into areas of
research, design, development, qualification, acceptance, and
checkout. The discussion of development flight tests, which will be
restricted to those using other than production spacecraft, consists
of research studies, development tests, and qualification programs.
The performance of the production spacecraft will be discussed

Figure 3-3. Photograph of spacecraft
interior.

in a later section of this paper. It is
interesting to note that because of the rapid pace dictated by the
high priority of the program, many of the individual test programs
were conducted concurrently. This technique involved some risk,
since, had a major problem developed, the expense in both time and
money could have been considerable. The following paragraphs relate
the more salient lessons learned during the formal Mercury
development and qualification test program.

Ground Testing

The research tests included those which
attempted to verify design theories or sought new methods for
accomplishing a given design task, whether it was a structural
assembly, a heat-protection system, or improved methods of
instrumenting the spacecraft and its crew. Hundreds of tests of this
type, particularly those conducted in the wind tunnel, were
[45]
carried out in the early phases of the Mercury effort at many of the
NASA centers and at the contractor's plant. These tests will always
be required when a new flight spectrum in a relatively unknown
operational environment is penetrated, as it was in Mercury. It was
tests of this kind which established the basic Mercury configuration,
a shape which has already been projected into more advanced manned
space programs.

The design testing, exemplified by the
breadboard layouts in the case of electrical and sequential
circuitry, was conducted jointly by the NASA and the contractor. This
effort made possible the proof testing concurrent with initial design
studies. Many thousands of tests were conducted, such as those in the
design of the spacecraft-control-system thrust chambers, once the
initial concept had been established.

When the basic design concept had evolved to a
working hardware item, development testing served to expose this
concept in the laboratory to the many combinations of operational and
environmental conditions expected in space. Development testing was
naturally hampered by the fact that weightlessness, a prime example,
could not be adequately simulated on the ground; and this very
deficiency resulted in an ineffective design for the water separation
device of the environmental control system. The development of
Mercury systems was a continuing program through the final mission
and was aimed at mission flexibility, even after the spacecraft had
been basically qualified for manned orbital operation. It was during
the development testing that facets of the design which pertain to
all aspects of its use were most evident, including the
design-for-operation standards. It is in this testing area that
engineering mock-ups have proved to be extremely valuable. In the
case of the landing system, drop tests of boilerplate spacecraft were
made to develop the landing-system deployment sequence and operation.
Tests were made in the altitude chamber to verify that systems could
operate for their required life cycle under realistic conditions. In
essence, the development- test phase provided a means of validating
the design concept and proving its intended reliability
features.

Qualification testing conducted on the ground
can further impose realistic operational conditions on a test article
in various combinations for the specific purpose of verifying its
reliable operation for inclusion as a final flight article. That is,
there can and should be more shall one type of qualification program
for a given component, subsystem, or system, but these programs
should become progressively more demanding on the capability of the
hardware. In this testing, area, adherence to prescribed test
criteria must be rigorously enforced. The various combinations of
qualification tests can be grouped into environmental tests, load
tests, and performance tests with each of these groups having a
specific purpose. Sometimes, the test conditions are not realistic
enough or are not sufficiently demanding to reveal system weaknesses.
During Mercury, for some of the subsystems, it was not until the
actual unmanned flights that a system could be fully qualified for
manned operation. For example, the launch-escape tower was subjected
to all expected environmental conditions, all exhaustive series of
load tests, and the operational situations associated with the
launch- escape-system performance tests. Yet in the actual
qualification flight program the heating loads on the truss structure
of the tower were found to be more critical than had been calculated.
Ground qualification is relatively inexpensive compared with
full-scale flight qualification, and any system discrepancies which
can be revealed in this phase will yield rewards in terms of time and
expenditures later on. For example, during an early qualification
test, it was found that the original igniters in the retrorocket
motors would sometimes fail and blow out through the rocket nozzle
before the main propellant grain had been ignited. New igniters,
actually miniature solid rockets, were substituted for the original
igniters. Had this system characteristic been overlooked through the
manned orbital flights, the consequences could have been
catastrophic. For flight-acceptance tests on units scheduled to be
installed in flight vehicles, however, it was found that care should
be taken not to over-test the article to the point at which its
useful lifetime is approached or exceeded. During qualification
testing, one must be assured that the unit being tested is not a
"handmade" article and that, later on, a similar production version
will not fail because it does not have the same ability to withstand
the [46]
testing environment. Of course, a critical requirement for the
qualification program is that the test conditions imposed on the
hardware exceed those expected to be present in the design
environment in order to provide a safe margin for manufacturing
deviations and unanticipated design weaknesses. It was found in
Mercury that no single qualification criterion necessarily applies to
all systems, and local operating conditions must be evaluated
specific ally for each system to insure that they are adequately
accounted for in the qualification test environment.

It was learned in Mercury that, whenever a
significant design change is to be incorporated into the spacecraft,
a new hardware qualification program should be initiated to requalify
major systems. Approximately 1,000 hours of test time were
accumulated on a full-scale spacecraft in a program called "Project
Orbit" which was conducted in a vacuum-thermal facility to insure
that, during the orbital flight program, systems would maintain their
previously demonstrated performance. is an example, when the
spacecraft thruster assemblies were modified as discussed in this
paper, the modified assemblies were tested in a vacuum chamber as
part of the Project Orbit testing. These tests, using hydrogen
peroxide, were made to determine if exposure to combined temperatures
and low pressures for the expected duration of the mission would have
adverse effects on the operation of the thruster assemblies. It was
found to be most effective if actual operating conditions and
procedures, including preflight checkout tests, could be
realistically simulated in order to expose hardware to a complete
operating cycle. Since system qualification and operating reliability
are so closely related, the reader is referred to the paper entitled
"Reliability and Flight
Safety" for additional details.

Finally, the acceptance and checkout tests
which are conducted by using actual flight hardware involve the same
recommendations previously mentioned, those of avoiding over testing,
realistic operational test conditions, and thoroughness. It was
learned in Mercury that, if tests of this type are conducted at
multiple stations across the country by separate groups, the test
procedures must be consistent if the test results are to be
comparable. It is essential to repeat a system checkout if the system
has been disturbed for any reason, such as the removal of another
system where a definite interface exists. The acceptance and checkout
aspect of ground testing is more thoroughly discussed in the paper
entitled "Spacecraft
Preflight Preparation."

Flight Testing

This brief discussion of the development
flight phase of Mercury will be limited to those flights where
specially configured test vehicle (boilerplate spacecraft) were
employed. Because the experiences gained by flights of production
spacecraft are of more operational significance, they will be
presented in the next section, Systems Performance. The flight-test
program began with a number of tests in which spacecraft models were
flown by using small multistage rockets. These tests provided
preliminary data on the aerodynamic properties of the chosen external
configuration. Almost concurrently with these flights, tests of the
parachute systems were staged in which boilerplate spacecraft were
dropped from cargo aircraft. These "drop tests" were initiated as an
important step in the early design and development of the landing
system. Specifically, the drogue parachute was developed by utilizing
a weighted pod, which was dropped from an aircraft at high altitude.
Other early flight tests included off-the-pad, or beach, aborts to
develop the launch- escape system. In 1959, a reentry flight was
conducted in which a specially designed and instrumented spacecraft
and an Atlas launch vehicle were used to provide aerodynamic-heating
data in the real flight spectrum. This flight, termed "Big Joe, was
the first test in Mercury in which the Atlas was used. It was as a
result of the data derived during this flight that the shingles
initially on the spacecraft cylindrical section were replaced with
somewhat thicker shingles made of beryllium to provide for more
effective heat protection. The final series of early flight tests
used the solid-propellant Little Joe vehicle (shown in fig. 3-4) to
test the launch-escape system concept at critical inflight abort
condition. Although most of the early flight tests were of a
developmental nature, their missions served to qualify critical
flight systems for later, more demanding flight tests. The
intermediate series of aircraft drop tests, for instance, was
[47]
completed to qualify the parachute and landing-shock attenuation
systems. During this test phase in Mercury, valuable system
improvements were incorporated at a minimum of cost and time.

Figure 3-4. Mercury Little-Joe
launch-vehicle configuration.

Weight Growth

A critical problem which was present
throughout the Mercury program was that of weight growth. This
problem, which seems to be characteristic of any development program
where high performance and reliability are required, almost defies
the steps taken to control weight. Figure 3-5 depicts the weight
chronology of the spacecraft s orbital configuration. The maximum
growth in weight was approximately 10 pounds per week in the very
early phases of the program, but this figure was reduced to less than
2 pounds per week, or approximately 1/2 percent, at the final stage
of the program. The launch weight of Astronaut Cooper's spacecraft,
Faith 7, was some 700 pounds greater than the original design weight,
despite repeated design reviews and other continuing weight controls.
The lesson here is that proper planning must account for the
inevitable weight growth in the design and development of
high-performance spacecraft, since the consequences of not planning
for it are either a degradation of the performance goals or exceeding
the capability of the launch vehicle with its attendant
delays.

Attention to Detail

One of the most significant lessons learned
from the Mercury program was the need for a careful and continuing
attention to quality and engineering detail in all phases of the
program. The spacecraft is made up of many individual systems and
components to form a complex entity, and only through a close
monitoring of the design and development of each piece of hardware
and its relationship to all other associated components is it
possible to recognize and correct problems rapidly before a costly
failure occurs. Many performance discrepancies could not be
anticipated because of the lack of experience or the inability to
simulate adequately realistic conditions in the early test program.
Later tests, however, were established to reveal these anomalies with
a minimum of cost and delay. Although somewhat limited by the lack of
experience, attention to detail during the design phase resulted in
the incorporation of

[48] system redundancy,
where a direct relationship to mission success existed.

As a prime example of the attention given to
the incorporation of redundancy in the detailed design of critical
spacecraft components, the actuation system of the
launch-escape-tower clamp ring w as backed up in nearly every
component because of the serious consequences that would have
resulted from a failure of the escape tower to jettison. In this
system, the clamp ring is assembled at three points on its periphery,
with each point being held by a dual explosive unit. Five of these
six pyrotechnic units were ignited by an electrical squib, whereas
the sixth was actuated by a percussion cap. Each of the electrical
units incorporated a dual bridgewire. The automatic sequence was
designed to send electrical signals from one power source to six of
the bridgewires, with another but independent electrical supply for
the remaining four bridgewires. Should the automatic relay fail, the
astronaut was provided with a manual pull-ring which would energize
the same jettison relay and also operate a gas generator to initiate
the percussion cap, such that, in the event of failure in both the
circuit to the sequencing relay and the two separate electrical power
buses, the percussion cap would ignite. Actuation of any one of the
six pyrotechnic explosive bolts was sufficient to effect proper
separation of the escape tower from the spacecraft. The pyrotechnic
circuit for the spacecraft-launch-vehicle adapter clamp ring was
operated in a nearly identical manner.

During the development phase, an adherence to
test specifications was maintained through a continued scrutiny of
detailed performance results as they became available. Throughout the
manned flights, attention to detail was necessary for an early
recognition of possible problem areas, provided a means of responding
to suggested action items, and precluded the occurrence of some
system failures which ordinarily would have caused launch
postponements and possibly a catastrophe.

Systems Performance

During the design of the Mercury spacecraft,
one of the most important considerations was that, should individual
components or even entire systems fail, some means would exist either
to complete the mission safely or to conduct a successful mission
abort so that crew safety would be maintained. A summary of the
flight program objectives and results for the full scale spacecraft
is given in table 3-1. Of primary significance in the table is the
fact that during the manned flight phase, all major systems operated
satisfactorily, although on three of these missions, the astronaut
was required because of improper operation of the automatic control
system, to conduct the retrofire maneuver manually. There were system
malfunctions and performance discrepancies in each of these flights,
but they were of such a nature that either a backup system or
astronaut could circumvent the anomaly or that the failure of a
component, such as an instrumentation sensor was not critical to
mission success. The system experience during the flight program was
characterized by a number of isolated component anomalies, rather
than a critical failure of such magnitude that a catastrophe
resulted. This system development, accounting for system malfunctions
and performance discrepancies, the action taken to correct them, and
the steps required to increase system capability for the extended
flight of Astronaut Cooper, is discussed in the following paragraphs.
Since system anomalies are discussed specifically as they pertain to
the continuing development of the major spacecraft systems,
references 5, 6, 8 and 10 should be consulted for a more detail
performance discussion. Although random failures and system
deficiencies are mentioned briefly herein, the greater emphasis is
placed on system performance as it relates to design experience and
the lessons which can be derived from actual operation of the systems
in the space environment. Throughout the flight program, with the
exception of the MA-9 mission, no changes were required specifically
to accommodate a longer flight duration. The modifications made to
the Faith 7 (MA-9) spacecraft including those incorporated to make
possible the extended flight period are summarized in table 3-II.
Each major spacecraft system will be discussed separately, as in
previous reports on the individual manned flights (refs. 5, 8, an
10).

[49] Heat Protection System

The heat protection system performed
satisfactorily throughout the entire program and essentially as
designed.

Some cracking and slight delamination of the
ablation heat shield following reentry have been experienced on
certain flights, but this occurrence has been of no real consequence.
It was established that this minor delamination did not occur during
the reentry heating period and probably resulted from the shock
sustained at landing Since the flotation attitude depends somewhat on
the heat-shield weight, a slight modification was made to the Faith 7
spacecraft to provide for retention of any small portions which might
possibly have broken away after touchdown. It has always been
desirable to achieve the most upright position in the water to
facilitate astronaut egress.

Temperature measurements were made at various
depths in the ablation shields for the orbital flights, and the
maximum values experienced during reentry are summarized in figure
3-6 for each flight. The measurements showed good agreement with
predicted values and were satisfactory.

Mechanical and Pyrotechnic
Systems

The mechanical and pyrotechnic systems consist
of the separation devices, the landing system, the rocket motors, and
the internal spacecraft structure. Each of the systems in this group
is discussed separately.

There have been only minor problems with the
separation devices. The primary separation planes (shown in fig. 3-7)
are those between

the launch-escape tower and the spacecraft
cylindrical section, between the spacecraft and the launch vehicle,
at the heat shield, and at the spacecraft hatch. In three of the
earlier unmanned qualification flights, some difficulty was
experienced in separating the spacecraft adapter umbilicals, but
postflight examinations showed that the pyrotechnic charges ignited
satisfactorily. Further investigation revealed, however, that
aerodynamic loads during clamp-ring separation had caused the
clamp-ring segments to damage the umbilicals. A minor redesign of the
clamp-ring cover which protects these separation devices eliminated
the problem. In the Mercury-Redstone 4 (MR-4) mission, the
explosively actuated side hatch, incorporated for the first time for
this flight, was prematurely released. The astronaut egressed rapidly
through the open hatch, and the spacecraft subsequently took on sea
water and sank before recovery could be effected. A postflight
investigation involving a thorough analysis and exhaustive testing
was conducted, but the cause of the malfunction has never been
established. However, the landing and recovery procedures were
altered for succeeding missions to minimize the possibility of this
malfunction recurring. The only other performance anomaly with regard
to separation devices occurred in the recent flight of Astronaut
Cooper. Here,

four of the five umbilicals, two between the
spacecraft and the adapter and three between the spacecraft and the
retropackage (fig. 3-8) failed to separate in a normal manner. Later
analysis revealed that each of the malfunctioned disconnects (see
fig. 3-9), which normally contained a dual charge came from a special
test lot which did not contain the main charge of explosive powder.
Somehow, this lot had been improperly marked as intended for flight
hardware. The umbilical which separated normally contained the
intended amount of explosive and came from a properly identified lot.
The four umbilicals which failed to separate pyrotechnically were
released through actuation of a backup mechanical device. This
experience points up the necessity for close control of flight
articles and a means for establishing that the hardware intended for
flight satisfies prescribed specifications.

The landing system, which includes the main,
reserve, and drogue- stabilization parachutes and the landing-shock
attenuation system (landing bag), has never failed in flight during
the production-spacecraft flight program. In the second
Mercury-Redstone mission, the heat shield was lost after landing
because the metal retaining straps and landing bag material to
[53]
which the shield was attached failed as a result of wave action and
strengthening of existing straps for later spacecraft eliminated this
problem. The only other anomalies in the operation of the landing
system were concerned with the altitude of parachute deployment, and
these. anomalies are discussed in the Electrical and Sequential
Systems section. The successful performance of the landing system,
particularly the parachutes, can be attributed to a thorough test
program involving some 80 air drops of full-scale spacecraft.

Figure 3-8. Spacecraft photograph
displaying retrorocket umbilicals.

The rocket motors include the launch-escape
motor, the retrorockets, the posigrade rockets, and the
launch-escape-tower jettison motor. All of the rocket motors used
solid propellant, and their nominal thrust values are indicated in
table 3-III. Each of these rocket systems has operated satisfactorily
throughout the Mercury flight program. It was found early in the
program the launch-escape tower did not separate rapidly enough from
the spacecraft after an off-the-pad test because of thrust
impingement on the tower; therefore, the tower-jettison rocket-nozzle
configuration was subsequently changed from a one-to a three-nozzle
arrangement. Because of reliable launch-vehicle operation, the
launch-escape system was never needed for an atmospheric abort during
the manned flight program, and the large escape motor successfully
ignited each time when the system was normally jettisoned. An abort,
however, occurred during the unmanned MA-3 mission, and the system
operated satisfactorily.

Figure 3-9. Schematic diagram of
explosive umbilical disconnects.

Table 3-III. Nominal Rocket Motor
Characteristics.

Rocket Motor

Number of motors

Nominal thrust each, lb

Approximate burning time each, sec

Escape

1

52,000

1

Tower jettison

1

800

1.5

Posigrade

3

400

1

Retrograde

3

1,000

10

The internal spacecraft structure has been
compromised only once during a mission critical situation, a record
which is essentially proved by the fact that water, following an
ocean landing, had never entered the spacecraft in appreciable
amounts, except in one instance, because of a structural failure. In
the MR-2 mission following landing recontact of the heat shield with
the large pressure bulkhead caused puncturing that resulted in a
sizable leakage rate.

[54] The spacecraft was
recovered, however, within a safe period. During postflight
inspections of all manned spacecraft, some evidence of recontact by
the heat shield upon landing has been present, but this damage to the
large pressure bulkhead has been slight. The integrity of the
spacecraft's load-carrying structure was especially proven during the
Little Joe flight program. In one of these flights, the late ignition
of one of the Little Joe rocket motors caused the trajectory to be
considerably flattened, and as a result the spacecraft was exposed to
loading conditions approximately twice those expected for a normal
flight.

Spacecraft Control
System

The spacecraft control system provides for
attitude control and rate stabilization of the spacecraft during the
orbital and reentry phases. In addition to the system electronics,
the spacecraft control system is composed of two independent reaction
control systems (RCS), one of which supplied fuel for the automatic
stabilization and control system (ASCS) and fly-by-wire (FBW) modes
and the other which, until MA-9, supplied the manual proportional
(MP) and the rate stabilization and control system (RSCS) modes. The
RSCS unit was installed in the MR-4 and subsequent flights as a
backup to one of the secondary modes of the ASCS, that of auxiliary
damping. This unit was removed as unnecessary for the MA-9 flight,
with major deciding factors being its high fuel- consumption
characteristics and weight. The FBW and MP modes were available for
direct manual control by the astronaut, initially as backups to the
ASCS and in the final two orbital flights as modes of equal priority.
Although the control system has operated adequately in all of the
manned flights, largely because of the ability of the pilot to
exercise precise attitude control manually, this system has exhibited
failures of one type or another in nearly every flight. The one
exception was the six-pass mission of Astronaut Schirra, in which the
system operated correctly.

The single most prevalent malfunction in the
control system during the early manned flight program was the
intermittent failure of the small 1-pound thrust-chamber assemblies
(thrusters). In addition, during a manned suborbital flight (MR-3) a
6-pound thruster also failed to produce thrust when required. During
the flight of Astronaut Glenn, intermittent failures of the 1-pound
pitch and yaw thrusters would have caused a similar early termination
of the mission had the pilot not been present to exercise his manual
control option. Immediately following the first inflight thruster
failures, a complete analysis was begun to determine the exact cause
of the system discrepancy. In the postflight inspections for the
MR-3, MA-5, and MA-6 spacecraft, small particles were discovered at
critical points in the thrust chamber assembly, and for the MA-5
mission a large metal deposit which partially blocked the thruster
orifice was found. Although thruster malfunctions were experienced
during the MA-4 flight, the postflight inspection did not reveal any
thruster valve contamination. The exact mechanism for transporting
these particles, some of which were found to be broken pieces from
the stainless-steel dutch-weave screens which distributed the flow,
to upstream points is still unknown. Three steps were taken for the
MA-7 mission to correct this anomaly, one being the replacement of
the dutch-weave screens with a combination of stainless-steel fuel
distribution plate and platinum screens, another being the reduction
of the bore and size of the heat barrier, and the third being, the
relocation of the fuel-metering orifice, to the upstream side of the
solenoid valve (ref. 8). While these changes constituted the MA-7
modification, a more refined design change was being developed and
qualified in the Project Orbit altitude chamber tests. This
configuration, compared in figure 3-10 with previous 1-pound thruster
configurations, involved both the 1- and 6- pound thrusters and was
installed in the MA-9 spacecraft. No thruster failures of this type
occurred on either the MA-7, MA-8, or MA-9 flights after the
modifications had been successively incorporated.

The horizon scanners, which were used to
provide an external reference for the attitude gyros, were a source
of difficulty in the earlier orbital flights. In the MR-4 flight
after tower jettisoning, the scanner was observed to be generating
unexpected ignore signals, the cause of which was later traced to the
impingement and heating effects caused by the ignition of the
launch-escape rocket. A modification to the horizon-scanner cover
eliminated this problem.

In the MA-4 flight, both scanners exhibited
output variations which could not be correlated with- attitude
changes, and this anomaly was subsequently found to have been
partially caused by "cold-cloud effects"; in addition, a shorted
capacitor in the scanner circuit contributed to the attitude
discrepancy. Since the scanner unit had been designed without
accurately taking into account the effect of high-altitude cloud
formations in the view field, a temporary modification of altering
the bias levels was made for the MA-5 flight, but this change did not
completely eliminate the problem. Further system refinement involving
signal clipping for the earth portion of the view resulted in a
successful modification for the first manned orbital flight. Since
that time, only isolated occurrences of "cold-cloud effects" have
been observed. During the MA-7 flight, a horizon-scanner circuit
failure (see ref. 8) of another type occurred, but because the
antenna canister was normally jettisoned prior to landing, it was
impossible to conduct a postflight inspection of the hardware and
determine the cause of the failure. This malfunction, which occurred
in the pitch scanner, is believed to have been random in nature
within the scanner circuitry.

The only remaining control system problem of
any consequence during the full-scale flight program was the
existence of an open circuit in the pitch-rate gyro input to the
amplifier-calibrator (Amp-Cal), or autopilot, during the MA-4
mission. The Amp-Cal is the electronic unit which generates automatic
control system logic for the various ASCS operating modes. The
partial loss of gyro information to the autopilot caused the
spacecraft attitude to be in error at retrofire, which in turn
resulted in the MA-4 spacecraft's landing some 75 nautical miles up
range of the intended point. This malfunction was either not detected
during preflight tests or it occurred during the flight.

Although the control system performed
satisfactorily during Astronaut Cooper's mission, an electrical short
circuit, which occurred at two of the power-carrying plugs into the
autopilot and resulted in the loss of the automatic control mode
during the final few orbital passes. However, because this
malfunction occurred at this specific interface and is primarily of
an electrical nature, it is discussed in a later paragraph under
Electrical and Sequential Systems. Because of the loss of the
automatic control mode during the retrofire and reentry flight
maneuvers, the astronaut conducted these maneuvers by using both
manual modes available to him.

The only other major modifications to the
control system for the 1-day mission of Astronaut Cooper were the
addition of a 15-pound capacity fuel tank, which is shown in figure
3-11, and the incorporation of the interconnect valve between the two
RCS systems for better fuel utilization, in an emergency, and for
more effective fuel jettisoning.

Communications Systems

The original design configuration of the
communications systems proved to have been the most conservative of
all of the major systems. These systems-the voice transceivers, the
radar beacons, the location aids, and the command receivers operated
satisfactorily throughout the [56] flight program.
Because of the excellent performance of these systems, some of their
backup units were deleted, including one of the two command receivers
and decoders and the high frequency (HF) recovery transceiver for the
MA-8 and MA-9 flights and the ultra-high frequency (UHF) backup voice
transceiver for the MA-9 flight. One of the two UHF telemetry
transmitters, which were part of the instrumentation system, was also
deleted as unnecessary for the MA-9 mission. A slow-scan television
system, shown in figure 3-12, was included for evaluation aboard the
Faith 7 spacecraft, but the quality and usefulness of its
transmissions were not satisfactory.

In the initial two manned orbital flights, it
was noted that signals were not being received from the HF recovery
transmitter, but because of the circumstances at the time of recovery
and the uncertainty of HF reception in the landing area, it could not
be established that an anomaly existed. However, when this
discrepancy still existed on the MA-8 mission,

attention was directed to the ineffectiveness
of the HF recovery beacon. Careful analysis revealed that when the HF
"whip" antenna was pyrotechnically deployed upon landing, the
spacecraft was usually not completely erect in the water. The
combination of the electrically conducting products of combustion
from the explosive charge used to extend this antenna and the fact
that it was extended under water are believed to be the cause of this
communications anomaly. The antenna was subsequently deployed by
using pressurized nitrogen gas, which is nonconductive, and it was
programed such that deployment would not occur until the antenna was
clear of the water. Reception from this beacon was satisfactory
during the MA-9 mission.

For the MA-8 flight, a pair of more sensitive
microphones was installed in the pilot's helmet and the increased
sensitivity apparently caused the background noise from the launch
vehicle to trigger the voice-operated relay in the air ground
circuit. For the MA-9 mission, these microphones were modified to
reduce background noise sensitivity such that this triggering action
ceased.

[57] Reports of reception
of HF voice communications during the first three manned orbital
flight were somewhat inconsistent with regard to quality, but the
periods allowed for a complete inflight test of the HF voice
equipment were also very brief. At any rate, because of reports that
reception of HF voice signals during the first two maimed orbital
flights was unsatisfactory' a special HF antenna was installed on the
retropackage for the MA-8 flight (see ref. 10). There were reports of
excellent reception of signals from this antenna during the flight at
ranges exceeding 2,000 nautical miles, while other reports stated
that even when the spacecraft was nearly overhead, the reception was
poor to unreadable. This inconsistency is not clearly understood, but
the effects of spacecraft attitude at the time of transmission, the
atmospheric propagation characteristics at the time of contact, and
the status of operational ground equipment remain as unknown
variables. A more closely controlled test of this special dipole
antenna was conducted during the MA-9 flight, and it was fully
successful. Although HF voice transmissions were heard during MA-8,
the results of MA-9 were more consistent and indicated reliable
operation. It might be mentioned that both the

pilots and ground-control personnel preferred
the UHF voice equipment to the HF system, particularly since none of
the missions were such hat nearly continuous communications were
required. The UHF communications, of course, are limited to
essentially line-of-sight ranges, but have signal-to-noise
characteristics superior to those of HF in flight. However, the MA-9
astronaut found HF communications quite useful during the long
periods in which he could not make UHF contact with a network
station. Although the command system has never been exercised for a
commanded abort, its performance has been entirely satisfactory
during other inflight exercises, such as the reception of signals for
instrumentation calibration in all orbital flights and for an
emergency voice communications test and a commanded wake-up tone in
the MA-9 mission. For the unmanned orbital flights, MA-4 and MA-5,
the command system was successfully used to control the operation of
the spacecraft and bring it safely back from orbit.

Instrumentation System

The instrumentation system monitored over 100
performance variables and events throughout the spacecraft, and the
operation of this system was satisfactory throughout the entire
Mercury program. The system was designed with enough flexibility to
incorporate required instrumentation changes as the program
progressed. In the manned orbital flight phase, it was desired to
have a more complete temperature survey at discrete spacecraft
points, primarily on the spacecraft afterbody; and a low-level
commutator circuit was installed. This unit was deleted from the MA-9
spacecraft as having served its purpose and to save weight. The
confidence in the telemetry transmitters through the third manned
orbital flight led to a decision to eliminate one of the two
redundant units from the Faith 7 spacecraft to save weight. The
onboard recording capacity for the MA-9 flight was extended by
changing the tape speed from 1 7/8 inches per second (ips) to 15/16
ips and reprograming the operation periods such that only essential
information was recorded during the expected 34-hour period.

Probably the most widely known system
malfunction in the entire Mercury program is that associated with the
failure of a limit switch which sensed heat-shield release. During
the MA-6 mission, ground- control personnel received a telemetry
signal which indicated that the heat shield had been prematurely
unlatched from the spacecraft. Although it was believed that this
signal was improper and involved an instrumentation failure, a
decision was made to reenter with the retropackage attached to insure
that the heat shield would not part from the spacecraft during the
critical reentry heating period. A postflight examination of the
instrumentation revealed that a limit switch had a bent and loose
shaft (shown in fig. 3-13) and that manipulation of the sensor
without appreciably displacing the sensing shaft would generate an
erroneous signal. This experience prompted a change in the
installation technique and a directive for tighter quality-control
standards to insure that prescribed manufacturing tolerances would be
maintained. This type of malfunction did not recur in subsequent
flights.

Early in the flight program, beginning with
the Little Joe 5 mission, the mechanical spacecraft clock was found
to be sensitive to accelerations in excess of 5g. An electronic
digital clock was substituted for this unit and operated
satisfactorily.

During the MA-7 mission, the blood-pressure
measuring system (BPMS) yielded data which were of only marginal
value. The system was thoroughly checked out following the flight,
and no major system malfunction was found. It was shown, however,
that proper techniques, including establishing a proper amplifier
gain setting, correlation with clinically measured values, and the
fitting of the pressure cuff to the individual flight astronaut, were
not well understood. A thorough review of the entire system, its
operating characteristics, and the preflight calibration procedures
was conducted in the months after the MA-7 flight, and the data
quality for the MA-8 and MA-D missions was correspondingly improved
and resulted in usable values. A discussion of this anomaly from a
medical standpoint is presented in the Aeromedical
Preparations paper.

During the MA-D mission, the programer, which
automatically controls the operation and sequence of events of
certain spacecraft systems, exhibited two anomalies, one inherent and
the other resulting from a structural failure. The inherent anomaly,
evident to varying degrees in previous flights, involved a sensitive
control circuit containing transistors which actuated power relays to
operate the programer. This circuit was sensitive to certain input
voltage transients which occasionally caused undesired programer
operation. Prior to the MA-9 flight, a loading resistor had been
added to reduce the inherent sensitivity, and an on-off switch had
been incorporated so that the pilot could shut the system down if
improper operation occurred. On two occasions, the unit was
inadvertently triggered and continued to call for instrumentation
calibrations, one of its programed functions. On both occasions, the
[59]
astronaut turned the system off, and no serious consequences
resulted, but the need to improve system design for future programs
in this area, particularly for transistorized circuits, is
exemplified.

The other programer anomaly, although in a
separate section of the system, involved the shearing of a pin used
to maintain alinement of a gear in the programer drive mechanism.
Figure 3-14 depicts the misalined gear, which resulted in an inflight
binding of the programer and the preclusion of a significant portion
of recorded data during the midpoint of the MA-9 flight until the
astronaut switched from programed to continuous operation.

During the MA-9 flight, the respiration rate
sensor failed to yield reliable data during and after the fifth
orbital pass, but other sources of this information were found to be
adequate.

Figure 3-14. Misaligned gear in MA-9
programer.

A postflight investigation of the system
disclosed a broken solder joint at the attachment point of the sensor
lead.

Life-Support Systems

The life-support systems primarily provide for
control of the cabin and suit atmospheres, management of
metabolic-waste products, and the supply of food and liquid for the
astronaut. The major changes to the MA-9 life-support systems,
including the environmental control system (ECS) (fig. 3-15), from
those of previous missions were accomplished primarily in support of
the increased mission time, and the most significant modifications
were as follows:

(1) Addition of about 4 pounds of
primary breathing oxygen (02), stored under
pressure, for a nominal total of 12 pounds in the system.

(2) Increase in the carbon-dioxide
(C02) absorber, lithium hydroxide (LiOH), quantity from 4.6
to 5.4 pounds. The amount of activated charcoal, as the odor
absorber, was decreased from 1.0 to 0.2 pound, which was
sufficient.

(3) Increase in the stored coolant-system
water from 39 pounds to 48 pounds.

(4) Increase in the capability of the urine
collection and storage system.

(5) Addition of an improved condensate
collection and storage system, including a new wick-type condensate
trap (shown in fig. 3-16) to extract free water from the suit circuit
of the ECS.

(6) Increase of the stored drinking water by
4.5 pounds for a total of 10 pounds of potable water.

[61] A parallel coolant
control valve (CCV) shown in the upper right corner of figure 3-17
was added in the suit cooling-water circuit for redundancy with the
primary valve (top-left on the control plate) in the event of a
serious valve blockage by contamination, which was experienced in the
MA-8 mission.

The operation of the life-support equipment
during the MA-8 mission was normal, except that the suit-circuit CCV
was partially blocked by solidified lubricant and delayed the
astronaut's stabilization of the cooling system at a comfortable
level. Preflight procedures were changed for the MA-9 mission so that
the CCV's were cleaned and properly lubricated prior to flight, but
after the manned systems tests. The cooling water was also passed
through a 0.15 micron filter before being transferred into the
spacecraft. Blocking of the CCV during the MA-9 flight was not
experienced. However, the astronaut was required to make a large
number of minor changes to the suit CCV setting in an attempt to
maintain the heat-exchanger dome temperature, which was the cooling
system control parameter, within the desired range. No system
deficiencies or hardware malfunctions were found during the
postflight inspection or testing. It is a characteristic of

the system that changes in metabolic and
external suit-circuit heat loads as a result of changes in the
astronaut's level of activity, open visor operation, solar heat on
the spacecraft, and internal spacecraft equipment heating will be
experienced and will be reflected in the coolant requirements for the
suit heat exchanger. These heat-load changes are not radical under
normal conditions and the corresponding coolant flow changes would be
small compared with the capacity of the CCV. It is quite possible
that the sensitivity of this small-orifice valve, together with the
astronaut s normally varying metabolic heat loads, could have
resulted in the need for frequent coolant-flow adjustment.

An inline condensate trap, shown in figure
3-16 was designed to remove excess water from the suit-inlet hose and
was installed near the entrance point on the suit. The condensate
trap was activated periodically according to the flight plan by the
astronaut's opening a hose clamp on the water outlet line from the
trap. Condensate water was observed by the astronaut to have been
flowing through this line indicating that free water had probably
passed around the sponge.

During the 21st orbital pass, the carbon
dioxide (CO2) level at the LiOH canister outlet began to show an
increase on the C02 meter. Postflight chemical analysis of the canister
showed definite channeling of the flow through the canister.
Channeling is the localized or restricted passage of gas through the
canister, rather than a uniform flow for maximum C02 adsorption. This
channeling, which could reduce the effective canister lifetime, has
never been experienced during ground testing or during any previous
Mercury flight. Based on the amount of unused LiOH at the end of the
flight, approximately 27 hours of normal usage remained. However, the
actual operating capability of the canister could not be established
because of the channeling effects. The exact reason for its occurring
on MA-9 could not be established.

The cabin coolant water and fan were turned
off according to the flight plan during much of the MA-9 mission in
order to evaluate the effectiveness of the cabin cooling circuit.
During [62] this time, the electrical load varied according to
mission requirements, and the cabin temperature was observed to cycle
between 85° F and 95° F, as indicated in figure 3-18.
Reduction in the electrical load during this no-cooling period
resulted in corresponding reduction in cabin temperature. It is
concluded that cabin cooling was not required during periods in which
the Mercury spacecraft electrical system was powered down.

Problems were encountered during MA-9 with the
condensate transfer system. The needle of the hand-operated pump,
used to transfer liquid from the condensate tank to another
container, became clogged with metal shavings from the pump shaft and
the condensate could not be transferred. Normally, free water removed
by the condensate trap and sponge separator flowed directly to the
condensate tank, from which it was then intended to be pumped to
storage bags. The condensate tank contained a porous plus-to relieve
the gas pumped from the sponge into the tank by the action of the
sponge separator. Since it was known that this plug could pass water
when the tank became nearly filled, the astronaut elected to
discontinue operation of the condensate trap when the transfer pump
became clogged. This action was taken to stop further flow from the
trap to the tank and thereby help to preclude water from being
released into the cabin.

No malfunction of the life-support system
which compromised the mission or presented a marginal condition to
the man occurred during any of the manned Mercury missions. Although
minor malfunctions of equipment occurred on

these flights, some of which were alleviated
by the astronaut, none of these were repeated on successive flights.
The suit cooling system has exhibited a history of undesirable
operation, characterized by elevated suit inlet temperatures, wet
undergarments, and a general lack of astronaut comfort. However,
metabolic heat loads were removed sufficiently to keep body
temperatures well below a physiologically marginal value. The causes
of these cooling system problems for the suit circuit were twofold:

(1) Selection of an improper
cooling system control parameter during the initial design period.

(2) Ineffectiveness of the
suit-cooling-circuit water separator because of the unpredicted
behavior of free liquid in a weightless condition

Ground testing showed that the steam exhaust
duct temperature used in MA-6 and MA-7 missions was not an adequate
control parameter for controlling the operation of the heat
exchanger. A probe, which sensed the steam temperature at the
heat-exchanger dome (see fig. 3-19) between the two coolant
evaporating passes, provided a more rapidly responding indication of
the heat-exchanger operation. This control temperature parameter was
used during the MA-8 and MA-9 flights with satisfactory results. The
suit-inlet temperature range of 60° F to 70° F during most
of these two flights was more comfortable than the 75°F to
80° F range experienced during MA-6 and MA-7: See figure 3-20
for a summary of suit- inlet temperatures experienced during the four
manned orbital flights.

[63]
Figure 3-20. Time history for suit-inlet temperature for manned
orbital flights.

Other ground tests showed that water in the
suit circuit, when condensed from the gas stream in the heat
exchanger, was not carried by the gas flow to the sponge separator.
This water is believed to have been held under weightlessness to the
metal surfaces by surface tension and flowed from the cooling
surfaces to the duct walls, thereby probably passing around the
sponge in the separator. The condensate trap, which was installed in
the MA-9 ECS, verified the need for a trap which will remove free
condensate water traveling along the duct walls. Missions of even
longer durations will require the extraction of all free condensate
to keep the astronaut's body dry and thereby to obtain maximum
comfort and hygiene.

Electrical and Sequential
Systems

Except for some early development problems in
the sequential system, this system group has performed satisfactorily
throughout the Mercury program. Although there were no serious
sequential problems throughout the manned flight program, there was
an early deployment

of the main parachute during the MR-4 mission
and of the drogue parachute during MA-6. The reasons for these
premature deployments have never been fully understood, since no
system malfunction could be found during exhaustive postflight
testing. During the later manned orbital missions, a modification to
the sensing circuits for these sequential functions guarded against
premature automatic deployment. The contractor was instructed to
conduct a single-point failure analysis, which involved a detailed
study of the electrical and sequential circuitry to establish all
possible failure modes, and this analysis was conducted for all
spacecraft systems before the MA-7 flight. The results of this study
were evaluated for failure conditions that would singularly
jeopardize flight safety, and appropriate modifications were
incorporated into the MA-7 and subsequent spacecraft to improve
reliability. The greater portion of these changes involved the
electrical and sequential systems because of their unique
relationship to critical mission functions These changes dictated
paralleling of redundant sensing [64] elements in some
cases in which the actuation of either element could initiate the
proper function. In other cases where it was important that an event
signal not be sent early, some elements were changed to a series
function, as was done for the parachute-deployment circuitry.

The primary change to the electrical system
for the MA-9 mission was the replacement of two 1,500-watt-hour
batteries with two 3,000-watt- hour batteries. This change brought
the power supply up to one 1,500-watt-hour and five 3,000-watt-hour
batteries.

During the early phases of the flight program,
difficulty was experienced in maintaining the temperatures of the
electrical inverters below the maximum recommended operating level. A
cooling system was subsequently installed for the two main inverters,
but contamination problems and the limited effectiveness of this
cooling system did not alleviate the elevated temperature situation
appreciably. However, continued operation of these inverters from
mission to mission, in conjunction with ground test results, without
experiencing a temperature- associated failure, provided sufficient
confidence that these units would operate satisfactorily. Finally,
for the MA-9 mission, modified inverters with improved thermal
characteristics were installed in place of two of the old style units
(main 250 v-amp and 150 v-amp) and the open-cycle evaporative cooling
system was deleted. The three spacecraft inverters functioned
satisfactorily until late in the MA-9 flight when an electrical short
circuit prevented their operating properly.

In the MA-9 flight, the failure which caused
the greatest concern was first recognized at the early illumination
of the 0.05g sequence light, which indicated that the automatic
stabilization and control system (ASCS) had possibly switched to its
reentry mode of operation, which would have included the initiation
of rate damping and a steady spacecraft roll rate. Subsequent checks
by the astronaut revealed, in fact, that this control mode had been
enabled: A requirement for a manual retrofire maneuver was therefore
imposed on the astronaut, but it was still the plan to use the
autopilot during reentry. However, soon after this occurrence the
main inverter ceased to supply a-c power and, in the switchover to
the standby unit, this redundant element did not start properly.
(Refer to fig. 3-21 for details involving the ASCS and power
supplies.) Without a-c power for the control system, even the reentry
control configuration was disabled; therefore, the astronaut was
required to conduct this maneuver with manual control. This task was
further complicated by a corresponding loss of gyro attitude
indications because of the a-c power failure. A postflight inspection
and analysis

Figure 3-21. Relationship of electrical power to control system
autopilot.

[65] of the trouble areas
disclosed that n short circuit had occurred, both on the power plug
(shown in fig. 3-22) to the ASCS amplifier-calibrator and to another
connector ( see fig. 3-23), also part of the ASCS power circuit. Both
inverters under question were tested thoroughly after the flight and
found to operate within specification, indicating that they did not
contribute to the malfunction. Strong evidence exists that free water
in the spacecraft cabin had been present near the multipin power-plug
connection and eventually provided a current path in the insulation
between the d-c power and grounding pins shown in right-hand
photograph in figure 3-22. Pin N, labeled in the figure, was found to
have been completely burned off. Figure 3-23 clearly indicates the
significant corrosion revealed on the second connector during the
post-flight disassembly and inspection.

Postflight tests duplicated the above
hypothesis; that is, a short to ground could be effected upon
application of condensate water. Resistance measurements taken across
certain pins of the second plug immediately following the flight
indicated electrical paths that could have caused the 0.05g
indication. A likely source of the liquid which might have caused the
electrical short circuit was the porous vent of the condensate tank
in the environmental control system.

This tank is located in the proximity of the
autopilot power plugs, and normal cycling of the sponge squeezer
during the flight could have forced condensate through the vent.
Another possible source of water which could have produced the short
circuit is the local condensation of cabin humidity, which may have
been present because of a leak in the drinking- water valve or
because of water vapor exhaled by the pilot when his helmet faceplate
was open. Or the water droplets which leaked from the valve may have
somehow been deposited, in part, directly on the power plug. This
experience points up the need to minimize or eliminate the presence
of free liquid or high humidity in a spacecraft cabin where
electrical systems are functioning and to insulate and seal bare
electrical connectors more effectively.

The Mercury spacecraft systems design and
development phases were conducted concurrently and although this
philosophy involved a known risk, it made possible the early
realization of the project objectives. During this time, many
valuable lessons were learned and exploited in the development and
operation of manned space-flight systems.

In the system design, maximum use was made of
existing technology and off-the-shelf equipment, and systems concepts
were kept simple. However, some important advances in the technology
also had to be initiated. It was found that the spacecraft and its
systems must be designed for operational conditions. Examples of the
design-for-operation standard relating to the preflight activities
are system accessibility and the simplification of system interfaces.
It is also important in the early system design to allow for an
inevitable growth in weight.

During development and qualification testing,
the test criteria cannot be compromised in most instances, since an
overlooked system inefficiency will inevitably show up later where a
redesign is more costly. However, it was also found in Mercury that
no single qualification criterion necessarily applies to all systems,
and local operational conditions must be individually evaluated for
each system. Whenever system components are significantly modified,
as was done for the Faith 7 spacecraft to make possible the 34-hour
flight capability, a new ground test program for hardware
requalification should be administered to insure maintenance of
previous reliability and operational standards.

In the area of hardware operation and
performance evaluation, the Mercury flight program has been a most
valuable experience. The most important lesson learned from operation
of the spacecraft control system is that the pilot is a reliable
backup to automatic system modes. In fact, the pilot's ability to
control accurately the spacecraft attitude was instrumental in three
of the four manned orbital flights in completing the mission
successfully when a malfunction was present in the automatic system.
Another valuable lesson in both the control system and cooling system
designs was the avoidance of components which are especially
sensitive to contamination. The small valves used to meter reaction
control fuel and environmental control system cooling water should
have been designed to employ larger flow areas to reduce
susceptibility to particle blockage. Other than guarding against
stray voltages and sensitivity to transients, the major lesson
derived from the performance of the electrical . and sequential
systems was the need: to seal and insulate effectively all electrical
connectors from possible sources of free liquid and humidity in the
spacecraft cabin. In the life support system, it was also found that
the cooling systems must be designed with adequate margins and that
food, water, and waste management devices require particular
attention because of plumbing complexity and the effects: of
weightlessness.

Throughout the Mercury development and flight
programs, quality control and rigid manufacturing standards were
found to be absolutely mandatory if incidental flight failure and
discrepancies were to be avoided. Throughout the project, a careful
and continuing attention was given to engineering detail in order to
make possible the early recognition of system weaknesses and their
implications in the operation of flight hardware and to provide
meaningful and effective courses of action. This attention to detail
was an important reason for the success of the Mercury flight
program, particularly the manned suborbital and orbital
missions.

Acknowledgement. The authors wish to
gratefully acknowledge the analytical and documentary efforts of the
many NASA engineers and technicians who applied their knowledge and
foresight unselfishly during the postflight evaluations of the
various spacecraft systems for each Mercury mission and without whose
contributions this paper would not have been possible.